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Abstract 



This paper studies the capacity of single-source single-sink noiseless networks under adversarial or arbitrary 
' errors on no more than z edges. Unlike prior papers, which assume equal capacities on all links, arbitrary link 

capacities are considered. Results include new upper bounds, network error correction coding strategies, and examples 
of network families where our bounds are tight. An example is provided of a network where the capacity is 50% 
greater than the best rate that can be achieved with linear coding. While coding at the source and sink suffices in 
networks with equal link capacities, in networks with unequal link capacities, it is shown that intermediate nodes 

O ! 

may have to do coding, nonlinear error detection, or error correction in order to achieve the network error correction 
capacity. 
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I. Introduction 



Network coding allows intermediate nodes in a network to mix the information content from different packets. 
This mixing can increase throughput and reliability in networks of error-free or stochastically failing channels [T), 
0. Unfortunately, it can also potentially increase the impact of malicious links or nodes that wish to corrupt 
data transmissions. A single corrupted packet, mixed with other packets in the network, can potentially corrupt 
all of the information reaching a particular destination. To combat this problem, network error correction was first 
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studied by Yeung and Cai J3], @ who investigated correction of errors in multicast network coding ifTI. El, (51 
on networks with unit-capacity links. In that work, the authors showed that for any network of unit-capacity links, 
the Singleton bound is tight and linear network error-correcting codes suffice to achieve the capacity, which equals 
C — 2z where C is the min-cut of the network and z is a bound on the number of corrupted links [4, Theorem 
4]. The problem of network coding under Byzantine attack was also investigated in O, which gave an approach 
for detecting adversarial errors under random network coding. Construction of codes that can correct errors up to 
the full error-correction capability specified by the Singleton bound was presented in Q. A variety of alternative 
models of adversarial attack and strategies for detecting and correcting such errors appear in the literature. Examples 
include 151-1151. 

Specifically, the network error correction problem concerns reliable information transmission in a network with 
an adversary who arbitrarily corrupts the packets sent on some set of z links. The location of the adversarial links 
is fixed for all time but unknown to the network user. We define a z-error correcting code for a single-source 
and single-sink network to be a code that can recover the source message at the sink node if there are at most z 
adversarial links in the network. The z-error correcting network capacity, henceforth simply called the capacity, is 
the supremum over all rates achievable by z-error correcting codes. 

In this work, we consider network error correction when links in the network may have unequal link capacities. 
(A related model, where adversaries control a fixed number of nodes rather than a fixed number of edges was 
studied in |fT6l , independently and concurrently with our initial conference paper fTTl .) The unequal link capacity 
problem is substantially different from the equal link capacity problem studied by Yeung and Cai in [3J], H since 
the rate controlled by the adversary varies with his edge choice. In the error-free case, any link I in the network 
with capacity r can be represented by r edges of capacity one without loss of generality. However, in the case with 
errors there is a loss of generality in using a similar representation and assuming that errors have uniform rate, 
since this does not capture potential trade-offs that the adversary faces in choosing whether to attack strategically 
positioned or larger capacity links. The error-correction capacity in the equal link capacity case has a simple cut-set 
characterization since the adversary always finds it optimal to attack links on a minimum cut; as a result, coding 
only at the source and forwarding at intermediate nodes suffices to achieve the capacity for any single-source and 
single-sink network. In contrast, for networks with unequal link capacities, we show that network error collection 
coding operations at intermediate nodes are needed even in the single-source single-sink case. 

The cut-set approach is a simple yet powerful tool for bounding the capacity of a large network. This approach 
partitions the nodes into two subsets, say S and S c , and then bounds the rate that can be transmitted from nodes 
in S to nodes in S c . (See, for example, |fT8l Section 15.10].) The maximum information transmission across the 
"cut" occurs when the nodes within S can collaborate perfectly among themselves and the nodes within 5° can 
collaborate perfectly among themselves. In this case, S and S c each act as "super-nodes" in a simple point-to-point 
network. All that is needed for collaboration is sufficient information exchange among the nodes on each side of 
the cut. Thus, the "cut-set bound" equals that rate that would be achieved in transmitting information from S to 
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Fig. 1. The traditional cut set bound for a cut 5* between source s and sink t in the network shown in (a) equals the maximal rate 
that can be transmitted from S to S c when the nodes within S are allowed unlimited information exchange and the nodes within S c are 
allowed unlimited information exchange, as indicated by the thick bidirectional lines in (b). In the cut-set bounds employed here, we create 
infinite capacity connections only from each node to nodes of higher topological order on the same side of the cut, as shown by the thick 
unidirectional lines in (c). Restricting attention to nodes with input or output edges that cross the cut, gives a "zig-zag" network, as shown 
in (d). 

S c if we added reliable, infinite-capacity links between each pair of nodes in S and reliable, infinite-capacity links 
between each pair of nodes in S c , as shown in Figure [TJ Given a network of capacitated error-free links with a 
source node s and a sink node t, minimizing over all choices of S that contain s but exclude t gives a tight bound 
on the unicast capacity from s to t |fl9l . 

In contrast, this traditional cut-set bounding approach is not tight in general when it comes to the error-correction 
capacity of networks with unequal link capacities, even in the case of unicast demands. In this case, two new issues 
arise. We next describe each of these issues in turn. 

The first issue concerns the role of feedback across S - i.e. links from S c to S. While feedback never increases 
the capacity across a cut in a network of reliable links, it can increase the error-correction capacity. Intuitively, 
this is because feedback allows us to inform nodes in S about what was received by nodes in S c , thereby aiding 
in the discovery of adversarial linksO Treating all nodes in S as one super-node and all nodes in S c as another 
super-node, as in the traditional cut-set bounding approach, makes all feedback information available to all nodes 
in S and all feedforward information available to all nodes in S c . This may give them considerably more insight 
into the adversary's location than is available to them in the original network. 

We can obtain tighter bounds by taking into account limitations on which nodes in S c can influence the values 
on each feedback edge and which nodes in S have access to the feedback information. This is important in the 
unequal link capacity case, because it captures trade-offs faced by the adversary in choosing whether to attack links 
based on their capacity or whether they are upstream of feedback links that may give clues about the adversary's 
actions. Specifically, given an acyclic network Q, we construct an acyclic network Q' by adding a reliable infinite 
capacity connection from a node v G S to a node w G S only if Q contains a directed path from node v to node 
w via nodes in S, and adding a reliable infinite capacity connection from a node v G S c to a node w G S c only 

'This process of discovery is complicated by the fact that the feedback links themselves may be corrupted, but feedback is, nonetheless, 
clearly useful. 



if Q contains a directed path from node v to node w via nodes in S c . Figure [TJc) shows an example. Limiting 
the added connections in this way creates what we call a "zig-zag" network, as shown in Figure [TJ We draw only 
those nodes in S and 5 C with incoming or outgoing edges that cross between S and S c , and draw the nodes on 
each side of the cut in topologically increasing order. The "forward" edges across the cut point downwards in the 
diagram, while "feedback" edges point upwards. By studying the capacity of these zig-zag networks, we develop 
upper bounds on error-correction capacity that apply to general acyclic networks. We also illustrate the usefulness 
of these bounds by giving examples where they improve upon previously known bounds and showing that they are 
tight for families of networks that are special cases of zig-zag networks. 

However, the second issue with the cut-set approach to bounding network capacities is the notion of a cut 
itself. Reference |[20l shows, for the more general case where only a subset of links are potentially adversarial, the 
existence of networks for which no partition (S, S c ) yields a tight bound on the error-correction capacity. This is 
proven by example using a network whose minimal cut (which has no feedback links) yields a capacity bound that 
is proven to be unachievable. As a result, knowledge of the the capacity of the network's minimal cut is insufficient 
to determine the capacity of all possible networks, and we cannot hope to derive cut-set bounds that are tight in 
general. Nonetheless, given the complexity of taking into account the full network topology, we proceed to study 
the cut-set approach, deriving general bounds and demonstrating that those bounds are tight in some cases. 

Specifically, in Section III we begin with the cut-set upper bound given by the capacity of the two-node network 
shown in Fig. |2j which is the only cyclic network we consider in this paper. In this network, the source node can 
transmit packets to the sink node along the forward links and the sink node can send information back to the source 
node along the feedback links. As mentioned above, this cut-set bound can be quite loose since it assumes that all 
feedback is available to the source node and all information crossing the cut in the forward direction is available 
to the sink. We therefore develop a new cut-set upper bound for general acyclic networks by taking into account 
more details of the topological relationships among links on the cut, as in the zig-zag network construction shown 
in Figure [T] 

In Section IV, we consider a variety of linear and nonlinear coding strategies useful for achieving the capacity 
of various example networks. We prove the insufficiency of linear network codes to achieve the capacity by 
providing an example of a network where the capacity is 50% greater than the linear coding capacity and is 
achieved using a nonlinear error detection strategy. A similar example for the problem with Byzantine attack on 
nodes rather than edges appears in lfl6l . We also give examples of single-source and single-sink networks for 
which intermediate nodes must perform coding, nonlinear error detection or error correction in order to achieve 
the network capacity. We describe a simple greedy algorithm for error correction at intermediate nodes. We then 
introduce a new coding strategy called "guess-and-forward." In this strategy, an intermediate node which receives 
some redundant information from multiple paths guesses which of its upstream links controlled by the adversary. 
The intermediate node forwards its guess to the sink which tests the hypothesis of the guessing node. In Section V, 
we show that guess-and-forward achieves network capacity on the two-node network with feedback links of Fig. |2j 
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Fig. 2. Two-node network composed of n forward links and m feedback links. 
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Fig. 3. Four node acyclic networks: Given the cut Q — cut({s, B}, {A, i}), unbounded reliable communication is allowed from source s 
to its neighbor B on one side of the cut and from node A to sink t on the other side of the cut, respectively. There are feedback links from 
A to B. 

as well as the family of four-node acyclic networks in Fig. [3] when the capacity of each feedback link is not too 
small (i.e. above a value given by a linear optimization)]^ Finally, we apply guess-and-forward strategy to zig-zag 
networks, deriving achievable rates and presenting conditions under which our upper bound is tight. We conclude 
in Section VI with a discussion of future work. 

Portions of this work have appeared in our earlier work fTTl , 11211 . which introduced the network error correction 
problem with unequal link capacities and presented a subset of the results. 

2 After the submission of this paper, we obtained a new result that improves upon the bound in Section III for the special case of 
small-capacity feedback links. We mention the idea briefly as a footnote in Section III and will present it formally in an upcoming paper. 
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II. Preliminaries 

Consider a directed acyclic communication network Q = (V, £) with unequal link capacities. Let r(l) denote 
the capacity of edge I G £. A source node s G V transmits information to a sink node t G V over the network £?. 
Transmissions occur on the links according to their topological order, i.e. a link I transmits after all its incident 
incoming links, and we regard a link error as being applied upon transmission. A link (or node) is said to be 
upstream of another link (or node) iff there is a directed path starting from the former and ending with the latter. 
A link (or node) is said to be downstream of another link (or node) iff there is a directed path starting from the 
latter and ending with the former. 

In this paper, we consider the problem of correcting arbitrary adversarial errors on up to z links. The location 
of error links is fixed for all time but unknown to the network user. 

Definition 1: A network code is z-error link-correcting if the source message can be recovered by the sink node 
provided that the adversary controls at most z links. Thus a z-error link-correcting network code can correct any 
r adversarial links for r ^ z. 

Let (S, S c ) be a partition of V, and define the cut for the partition (S, S c ) by 

cut(S, S c ) = {(a, b) G £ : a G S,b G S c }. 

The cut cut(S, S c ) separates nodes a and b if a G S and b G S c . We use CS(a, b) to denote the set of cuts between 
a and b. Given a cut Q = cut(S, S c ), we call any link in Q a forward link, and we call any link from S c to S a 
feedback link. 

For the achievable strategies in Sections IV and V, we assume that coding occurs in the finite field ¥ q for some 
prime power q. An error on any link / G £ is specified by a vector e\ containing r(l) symbols in ¥ g . The output 
Hi of link I equals the sum in ¥ q of the input x; to link / and the error e\ applied to link I, i.e., yi = x\ + e\. We 
say that an error occurs on the link I if e/ ^ 0. 

As in 0, El, we can consider a linear network code V that assigns a set of r(l) vectors {v¥(l)i, v¥(l)2, .., v¥(l) r m}, 
called global coding vectors, to each link I G £ in the network. Let 

Uw) = {(w,vW(l) i ):l^i^r(l)} 

denote the error-free output of link I when the network input is w where (a, b) denotes the inner product of row 
vectors a and b. We use e = (ej : I G £ ) to denote the vector of errors on the entire network. The output of a link 
I is a function of both the network input w and the error vector e, which we denote by ijji(w,e). For each node 
v G V, we use r + (u) = {(c, v) : (c, v) G £} and r_(t>) = {(v,c) : (v,c) G £} to denote the sets of incoming 
and outgoing edges respectively for node v. With this notation, a sink node t cannot distinguish between the case 
where w is the network input and error e occurs and the case where w' is the network input and error e' occurs if 
and only if 

(Mw,e) : I G r+(i)) = (Mw',e) : I G T + {t)). (1) 
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Let N(e) = \{l G £ : e\ ^ 0}| denote the number of links in which an error occurs. We say that any pair of input 
vectors w and w' are z-links separable at sink node i if dTJ does not hold for any pair of error vectors e and e' 
such that N(e) ^ z and N(e') ^ z. Lemma 1 of O establishes the linear properties of ifti(w, e) for networks with 
unit link capacities. This result extends directly to networks with arbitrary link capacities. 
Lemma 1: For all I € £, all network inputs w and w' , error vectors e and e', and ji € ¥ q , 



From Lemma [TJ 

tpl(w, e) = ipi(w, 0) + V'K ) e ) = <M W ) + ^/( e ) ; 

where 0;(e) = V«(0> e ) f° r an y link /. Thus tpi(w,e) can be written as the sum of a linear function of w and a 
linear function of e. 



In this section, we consider upper bounds on network error correction capacity. Let X denote the source alphabet 
and q the size of the (arbitrary) link alphabet. The corresponding network transmission rate is given by ^f^p 

We first derive the cut-set upper bound obtained from coalescing all nodes on each side of the cut into a 
super-node, resulting in a two-node network as shown in Fig. |2] 

Lemma 2: Consider the two-node network shown in Fig. |2] with arbitrary link capacities. Let D p denote the sum 
of the p smallest forward link capacities. The network error correction capacity of this network is upper bounded 



Proof: Case 1) n ^ 2z. 

Suppose that C > and we show a contradiction. Since C > 0, there are two codewords x and y in X that can be 
sent reliably. When x is sent along the forward links and the leftmost z links are adversarial, the adversary changes 
x to x' so that the outputs of the [n/2\ leftmost links of x' are the same as that of y. Similarly, when y is sent 
along the forward links and the rightmost z links are adversarial, the adversary changes y to y' so that the outputs 
of the rightmost [n/2] links of y' are the same as that of x. Then the two codewords cannot be distinguished and 
this contradicts C > 0. 

Case 2) n ^ 2z. 

When the sink knows z adversarial links are the z largest capacities forward links, the maximum achievable 
capacity is -D n -z- When m ^ z and all m feedback links are adversarial, there are z — m adversarial forward links 
whose locations are unknown. In this scenario, we show that the best achievable rate is f n _2( z _ m ), which is the 



il>i{w + w' , e + e) = ipi(w, e) + ipi(w', e') 



and 



Ipl(Hw) = IJL1pl(w). 



III. Upper bounds 



by 
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sum of n — 2(z — m) smallest forward link capacities. We assume that |X| > q D ^-^-™) ) and show that this leads to 
a contradiction. F = .., l n } denotes the set of forward links such that the links indexed in increasing capacity 
order, i.e., r(l\) ^ ... ^ r(l n ). Since \X\ > q D »-H*-™) and D n _2( z - m ) is sum of the n — 2{z — m) smallest 
forward link capacities, there exist two distinct codewords x,x' € X such that (j>i t (x) = 4>i z (x') Vi = 1, ..,n — 2z. 
So we can write 

0(x) = {yi, ..,y n - 2z ,Pi, -,Pz,wi, -,w z }, 
0(x') = {yt, ..,y n - 2z ,Pi, ■;P , z ,w' 1 , ..,w' z }, 

where O(x) denotes the error-free vector of symbols on Q when codeword x is transmitted. 

We can construct z-error links that changes 0(x) to the value {yi, .., y n —2 Z iPii ■■■,p' Z i ■■■> w z] as follows. We 
apply an error of value (p' { — pi) mod q on links / n __2z+i for 1 ^ i ^ z. Since this does not change the output 
value of other n — z links, we obtain {y±, ..,y n ^2z,p[, ■ ■■,p' Z i .., w z }. For x' , we can follow a similar procedure 
to construct z error links that change the value of O(x') to {yi, .., y n -2z,Pi, ■■■ l p' z ,wi : -.,w z }. Thus, sink node u 
cannot reliably distinguish between the source symbol x and x', which gives a contradiction. 

Therefore, the upper bound on achievable capacity is min{D n _ z , D n ^2( z -m)+}- ■ 

In Section V we show that this bound is the actual capacity of the two-node network. Thus, the super-node 
construction gives the following cut-set upper bound for general acyclic networks. 

Lemma 3: Given any cut Q G CS(s, t) with k forward links and r feedback links, let D p denote the sum of the 
k smallest forward link capacities. The network error correction capacity is upper bounded by 

if k ^ 2z 

mm.{Dk-z,D k _2(z-r)+} it k > 2z 
However, we can show that the above upper bound is not tight using the following generalized Singleton bound, 
which was presented in our conference paper ifTTll . A similar upper bound for the problem of adversarial attack on 
nodes rather than edges was given in independent work lfT6l . 

Definition 2: Any set of links S on a cut Q G CS(s, t) is said to satisfy the downstream condition on Q if none 
of the links in Q\S are downstream of any link in 5*. 

Lemma 4: (A generalized Singleton bound) Consider any z-error correcting network code with source alphabet 
X in an acyclic network Q. Consider any set S consisting of 2z links on a source-sink cut Q G CS(s,t) that 
satisfies the downstream condition on Q. Let M = J2( a b)eQ\s r ( a ^) De ^ e tota ^ capacity of the links in Q\S. 
Then 

log|X| ^ M ■ \ogq. 

Proof: The proof is similar to that of the network Singleton bound for the equal link capacity case in 0. We 
assume that \X\ > q M , and show that this leads to a contradiction. 

Given a cut Q, K(Q) denotes the number of links in Q. For brevity, let Q = .., Ik(Q)} where S = 
{Ik(Q)-2z+i, ■■■ l K(Q)} and links in S are ordered topologically, i.e., l K (Q)-2z+i is not downstream of l K (Q)-2z+j 

8 



(source) 
s 




t 

(sink) 



Fig. 4. Four-node acyclic network: unbounded reliable communication is allowed from source s to its neighbor B on one side of the cut 
and from node A to sink t on the other side of the cut, respectively. There are 2 forward links of capacity 1 from s to A, 4 forward links 
of capacity 10 from B to t, and 3 feedback links from A to B. 

for any i < j. Since \X\ > q M and M is the capacity of Q\S, there exist two distinct codewords x,x' € X such 
that (j>i t (x) = 4>i t ( x ') Vi = 1, .., K(Q) — 2z. So we can write 

0(x) = {yi, ..,yK(Q)-2z,Pl, ~,Pz,Wl, ~,Wz}, 

O(x') = {yi,..,y K (Q)-2z, Pi, -.v'ziw'i-, -,w' z }, 

where O(x) denotes the error-free vector of symbols on Q when codeword x is transmitted. 

We will show that it is possible for the adversary to produce exactly the same outputs on all the channels in Q 
when errors occur on at most z links in Q. 

Assume that the true network input is x. The adversary will inject errors on z links Ik(q)-2z+i, ■■Jk(q)-z 
in this order as follows. First the adversary applies an error on link Ik(q)~2z+i to change the output from 
pi to p[. The output of links (Ik(q)-2z+2, ■•^k{q)) m ay be affected by this change, but the outputs of links 
(h, ~,Ik(Q)-2z) will not - Let PiU) and w'i(j) denote the outputs of links l K (Q)~2z+i and l K ^_ z+i , respectively 
after the adversary has injected errors on link lK(Q)-2z+j> where j = 1, 2, .., z with ^(1) = p[. Then the adversary 
injects errors on link Ir(q)-2z+2 to change its output from p' 2 (l) to p' 2 . This process continues until the adversary 
finishes injecting errors on z links Ik(Q)-2z+i, ••> Ik(Q)-z an d tne output of this channel changes from O(x) to 
{yi, .., Vk(Q)-2ziPv ■■iP'z-i w i( z )i ■•> w 'z( z )}- ^ ow su PP ose the input is x' . We can follow a similar procedure by 
injecting errors on z links Ik(Q)-z+1i ■■Jk(q)- Then the adversary can produce the outputs 

{Vi, -,yK(Q)-2ziP'\, ",P Z , w[(z), ..,w' z (z)}. 
Thus, sink node t cannot reliably distinguish between the source symbol x and x', which gives a contradiction. ■ 
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Consider the example four-node network shown in Fig. 01 When z = 2, the two-node bound lemma [3] gives the 
upper bound 22. The generalized Singleton bound gives upper bound 2. 

However, the generalized Singleton bound is also not tight. Building on ideas from the above bounds, we proceed 
to derive tighter bounds. 

Let Q R denote the set of feedback links across cut Q. Given a set of m ^ z feedback links W C Q R and a 
set of k ^ z — m forward links F C Q, we use 

N zmk(Q) t0 den ° te the 

upper bound obtained from lemma @] 

(generalized Singleton bound) when evaluated for z — m — k adversarial links on the cut Q after erasing W and 
F from the graph Q. Let 

N Zj k,m(Q) = r min min N zkLiQ)- 

{FcQ,\F\=k^z-m} {WcQ R ,\W\=m^z} 



Then we define N Z (Q) as follows. 



N Z (Q) = min min N zkm (Q). 

0<m<z Q<k<z— m 



For instance, consider the 2-layer zig-zag network in Fig. [6] If z = 4, k = 1 and m = 1, N z j, m {Q) = 19 by 
choosing F = {h}, W = {Iq}, and removing {I2, h, 14, 15} in the application of the Singleton bound after erasing 
F and W. By taking the minimum over k and m, we can show that N Z (Q) = 19. 

Lemma 5: (Cut-set upper bound 1) Consider any z-error correcting network code with source alphabet X in an 
acyclic network. 

log|XK min {N Z (Q)} ■ logq 

Qecs(s,t) 

Proof: For any cut Q € CS(s, t), the adversary can erase a set W C Q R of feedback links and a set F C Q 
of forward links where \W\ = m ^ z and \F\ = k ^ z — m. Applying Lemma [4] on Q after erasing W and F 
gives the upper bound N^fjQ). By taking the minimum over all cuts Q, we obtain the above bound. ■ 

The following examples illustrate how the bound in Lemma [5] tightens the generalized Singleton bound. We first 
consider a four-node acyclic network as shown in Fig. [5] In each example, unbounded reliable communication is 
allowed from source s to its neighbor B on one side of the cut and from node A to sink t on the other side of the 
cut. There are feedback links with arbitrary capacities from A to B. 

When we compute the generalized Singleton bound, for any cut Q, we choose and erase 2z links in the cut such 
that none of the remaining links in the cut are downstream of the chosen 2z links. Then we sum the remaining 
link capacities and take the minimum over all cuts. Because of the downstream condition, when the link capacities 
between s and A are much larger than the link capacities between B and t, the Singleton bound may not be tight. 
For example, in the network in Fig. [5] (a), if z = 2, then the generalized Singleton bound gives upper bound 20. 
However, when the adversary declares that he will use two forward links between s and A, we obtain the erasure 
bound 4. 

As another example, consider the network in Fig. [5] (b) when z = 2. Applying the generalized Singleton bound 
gives upper bound 16. If the adversary erases one of the forward links between s and A and we apply the generalized 
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(a) 



Fig. 5. Four-node acyclic network: unbounded reliable communication is allowed from source s to its neighbor B on one side of the cut 
and from node A to sink t on the other side of the cut, respectively, (a) There are 2 links of capacity 10 from s to A and 4 unit-capacity 
links from B to t. (b) There are 5 links of capacity 3 from s to A. There are 2 links of capacity 2 and 3 links of capacity 1 from B to t. 




Fig. 6. 2-layer zig-zag network: unbounded reliable communication is allowed from s to B, from B to D, from A to C, and from C to t 
respectively. There are sufficiently large number of feedback links from A to B. There is one feedback link from C to D. 

Singleton bound on the remaining network, then our upper bound is improved to 15. The intuition behind this 
example is that when the adversary erases k ^ z large capacities links which do not satisfy the downstream 
condition, applying the generalized Singleton bound on remaining network with [z — k) adversarial links can give 
a tighter bound. 

For the 2-layer zig-zag network in Fig. |6l when z = 4, the min-cut is 37 and the generalized Singleton bound 
gives upper bound 27. Suppose that the adversary declares that he will use the feedback link between C and D and 
the forward link with capacity 6 between s and A. By applying the generalized Singleton bound on the remaining 
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network with two adversarial links, we obtain 37-6-(3+3+3+3)=19. The intuition behind this example is that the 
links between B and C and the links between D and t have the same topological order once the single feedback 
link between C and D is erased. Since the generalized Singleton bound is obtained by erasing 2z links on the cut 
such that none of the remaining links on the cut is downstream of any erased links, erasing the single feedback link 
between C and D yields a tighter Singleton bound even with fewer adversarial links. Moreover, before applying 
the Singleton bound, we first erase the link with capacity 6, which is the largest link between s and A as we did 
in example in Fig. Ob). 

Next, we introduce another upper bounding approach which considers confusion between two possible sets of 
z adversarial links, each containing some forward links as well as the corresponding downstream feedback links 
required to prevent error propagation. Consider any cut Q = cut(P,V\P) and sets Z±,Z 2 C Q. We say that a 
feedback link I € Q R is directly downstream of a forward link I' G Q (and that I' is directly upstream of I) if there 
is a directed path starting from I' and ending with I that does not include other links in Q or Q R . Let W\ be the 
set of links in Q R which are directly downstream of a link in Z\ and upstream of a link in {Q\Z\)\Z 2 . Let W 2 
be the set of links in Q R which are directly downstream of a link in Z2 and upstream of a link in Q\Z 2 . 

Lemma 6: (Cut-set upper bound 2) Let M = b)&{Q\z 1 )\z 2 r (°' ^) denote the total capacity of the remaining 
links on (Q\ Zy)\Z 2 . If \Zi U W t \ < z for i = 1, 2, then 

log\X\ ^ M ■ logq. 

Proof: We assume that \X\ > q M , and show that this leads to a contradiction. Let K(Q) denote the number of 
links on the cut Q. Since |X| > q M , from the definition of M, there exist two distinct codewords x,x' € X such 
that error-free outputs on the links in {Q\Z\)\Z 2 axe the same. Let c = \Z\\ and d = \Z 2 \. Then we can write 

0{x) = {yi,:,yK(Q)-c-d,ui,.;U c ,wi,..,Wd}, 

O(x') = {yi,.-,yK(Q)-c-d,Ul,-;U' c ,w[,..,w' d }, 

where (yi, .., yK(Q)-c-d) denotes the error-free outputs on the links in {Q\Zi)\Z 2 for x and x'\ (ui,..,u c ) and 
(u' x , .., u' c ) denote the error-free outputs on the links in Z\ for x and x' respectively; and (wi, ■-,w,i) and (w[, .., w ' d ) 
denote the error-free outputs on the links in Z 2 for x and x' respectively. We will show that it is possible for the 
adversary to produce exactly the same outputs on all the channels in Q under x and x' when errors occur on at 
most z links. When codeword x is sent, we use B>i(x) to denote the error-free symbols on feedback link I. 

Assume the input of network is x. The adversary chooses feedback links set W\ and forward links set Z\ as its 
z adversarial links. First the adversary applies errors on Z\ to change the output from Ui to u' { for VI ^ i ^ c and 
to cause each feedback link I £ W\ to transmit B>i(x). Since all feedback links which are directly downstream of a 
link in Z\ and upstream of a link in {Q\Z\)\Z 2 transmit the error-free symbols, the outputs on links in {Q\Z\)\Z 2 
are not affected. The outputs on links in Z 2 may be affected, and we denote their new values by {w'{, ..,w^}. Thus, 
the sink observes {y h ..,y K (Q)-c-d, u 'n ~,u' c , w'{, ..,w' d [}. 
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Fig. 7. Four node acyclic network: There are 4 links of capacity 2 from s to A. There are 3 links of capacity 2 and 1 links of capacity 4 
from B to t. 

When codeword x' is transmitted, the adversary chooses feedback links set W2 and forward links set Z2 as its 
z adversarial links. The adversary applies errors on them to change (w±, ..,u>d) to (w'{, ...toj) and to cause each 
feedback link / S W2 to transmit Bi(x'). Since all feedback links which are directly downstream of a link in Z2 
and upstream of a link in Q\Z2 transmit the error-free symbols, the outputs on any other links are not affected. 
Therefore, the output is changed from O(x') to {yi, ■■,yK(Q)-c-di u 'i> ••> n ' C ; w 'ii ■•> w 'd\- Thus, the sink node t cannot 
reliably distinguish between the codewords x and x' , which gives a contradiction. ■ 

Given a cut Q, we consider all possible sets (Z\,Z?) on Q satisfying the condition of Lemma [6] We choose 
sets among them that have the maximum total link capacities and define M Z (Q) to be the sum of the 

capacities of the links in (Q\Z*)\Z2*. This gives the upper bound 

log|X|^ min M Z (Q) ■ logg. 

QGcnf (s,t) 

The following example shows that we can obtain a tighter upper bound using Lemma [6] For the example network 
in Fig. |7J when z = 3, Lemma [5] gives upper bound 9. However, Lemma [6] gives a tighter upper bound 8 when 
Z$ = {h,l 2 ,h} , and Z* 2 = {l 6 ,l 7 ,l 8 }. 

Now we derive a generalized cut-set upper bound that unifies Lemma [5] and Lemma [6] Given a cut Q, consider 
a set F C Q of forward links and a set W C Q R of feedback links such that \F\ + \W\ ^ z. Let Cz ,W (Q) denote 
the upper bound obtained from Lemma [6] when evaluated for z — m — k adversarial links on the cut Q after erasing 
F and W from the original graph Q. Then 

min C^ W {Q) 

{FdQ,W^Q R ,\F\ + \W\^z} 

is an upper bound on the error correction capacity of Q. This includes the bound N Z (Q) of Lemma [5] as a special 
case, since the generalized Singleton bound is a special case of the upper bound in Lemma [6] corresponding to 
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the case where Z\ U Z 2 is a set of 2z links satisfying the downstream condition. It is also clear that Cz' W (Q) is 
the same as the bound in Lemma [6] when F = W = 0. Note however that any bound C%' (Q) obtainable with 
a nonempty set W of erased feedback links is also obtainable by including those links in the sets W\ and W2 of 
Lemma [6] instead of erasing them. Thus, we define 



C g (Q) = min Cj' (Q) 
{FCQ,\F\^z} 



and state our upper bound as followsl 

Theorem 1: (A generalized cut-set upper bound) Consider any z-error correcting network code with source 
alphabet X in an acyclic network. Then 

loglXl^ min C Z (Q) -logo. 
QsCS{s,t) 

IV. Coding strategies 

We consider a variety of linear and nonlinear coding strategies useful for achieving the capacity of various 
example networks. We show the insufficiency of linear network codes for achieving the capacity in general. We 
also demonstrate examples of networks with a single source and a single sink where, unlike the equal link capacity 
case, it is necessary for intermediate nodes to do coding, nonlinear error detection or error correction in order to 
achieve the capacity. We then introduce a new coding strategy, guess-and-forward. 

A. Error detection at intermediate nodes and insufficiency of linear codes 

Here we show that there exists a network where the capacity is 50% greater than the best rate that can be 
achieved with linear coding. We consider the single source and the single sink network in Fig. [8j where source s 
aims to transmit the information to a sink node t. We index the links and assume the capacities of links as shown 
in Fig. [8] For a single adversarial link, our upper bound from Theorem Q] is 2. 

Lemma 7: Given a network in Fig. [8j for a single adversarial link, rate 2 is asymptotically achievable with a 
nonlinear error detection strategy, whereas scalar linear network coding achieves at most 4/3. 

Proof: We first illustrate the nonlinear error detection strategy as follows. Source wants to transmit two packets 
(Pi, P2). We send them in n channel uses, but each packet has only n — 1 bits. We use one bit as a signaling bit. 
We send (Pi,P2) down all links in the top layer. In the middle layer, we do the following operations: 

1. Send the linear combination of Pi and P2, aPi + 6P2, down link I4. 

2. Send Pi down both links I5 and 1$. 

3 After submitting this paper, we found a way to tighten the above bound for the case of small feedback link capacity. Briefly, the key 
idea is to note that instead of choosing all the links in Wi as adversarial links as in the proof of Lemma [6] another possibility is to choose 
only a subset Yi C Wi as adversarial links, as long as the values on links in Wi\Yi and links in Q\Zi that are directly upstream of links 
in Wi\Yi are the same under the two confusable codewords x and x'. The capacities of these links then appear as part of the upper bound; 
thus, this bound is useful for cases where feedback links have small capacity. This result will be presented formally in an upcoming paper. 
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Fig. 8. A single source and a single sink network : all links on the top layer have capacity 2. All links on the middle and bottom layer 
have capacity 1. When z = 1, the capacity of this network is 2 while linear network codes achieve at most 4/3. 

3. Send P2 down both links I7 and /§. 

4. Send a different linear combination of Pi and P2, cP\ + (IP2, down link 1$. 
At the bottom layer, we do the following operations: 

1. Forward the received packet on link Z10- 

2. Send a 1 followed by Pi on link In if the two copies of Pi match, send a otherwise. 

3. Send a 1 followed by P2 on link I12 if the two copies of P2 match, send a otherwise. 

4. Forward the received packet on link Z13. 

We can show that above nonlinear error detection strategy allows a sink node to decode (Pi,P2). Suppose that 
(a, b) and (c, d) are independent. Then coding vectors on any two links on the bottom layer are independent and 
they satisfy with MDS (maximum distance separable) properties. If nothing was sent down both In and I12, the 
decoder can recover (Pi,P2) from the information received on links Z10 and Z13. If nothing was sent down only 
on In, then the outputs of /12 and Z13 should not be corrupted and the decoder can recover (Pi,P2). Similarly, the 
decoder can decode correctly when nothing was sent down only on /12. If all the links in the bottom layer received 
symbols, there is at most one erroneous link on the bottom layer, which has MDS code. Thus we can achieve rate 
2 — - with this error detection strategy. 

Now we show that scalar linear network code can achieve at most rate 4/3. Suppose that we want to achieve the 
linear coding capacity k/n by transmitting k symbols reliably by using a scalar linear network code <fi over the 
finite field ¥ q in n rounds. To show the insufficiency of linear coding for achieving this capacity, from £T|), it is 
sufficient to prove that there exist pairs (w, e) and (w', e') for linear network code cj> such that 

(M^,e) : I e r+(t)) = OM^V) : I € T+(t)), 
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and N(e), N(e') ^ 1. Since the above equation is equivalent to 

&(w -w'):l€ T+(t)) = (0,(-e + e') : I € r+(t)), 
by linearity, it suffices to find a source vector x G X and error vector e" such that N(e") ^ 2 and 

Wx):ier + (t)) = (%"):iGr + (t)), (2) 

where X = F^ is the source alphabet. We will show that there exists (x, e") satisfying the above equation when 
errors occur on the links l\ and £3 in error vector e". 

Let denote the 4nx fe transfer matrix between s and t in the n rounds. Its rows are the global coding vectors 
assigned on Z10, hi, I12, and £13 in the n rounds. Note that to transmit k symbols reliably, Gt should have rank k. 

Let M\ and M 2 denote the transfer matrices between h and t, and between Z3 and t during n rounds respec- 
tively. To transmit k symbols reliably, both M\ and M 2 should have rank at least k, i.e., rank(M\) ^ k and 
rank(M2) ^ k. Otherwise, when the adversarial link is on the top layer, the maximum achievable rate is at most 
mm{rank(Mi),rank(M2)} from the data processing inequality, which gives a contradiction. 

Let ei and e 2 denote the errors occurring on links h and Is, respectively. Error e\ propagates to l\§ and In, and 
error e 2 propagates to l\2 and Z13. 

From (2), we have the following set of equations 

I M i \ 
G t x=\ \(e 1 ,e 2 y = M-e". 

\ M 2 J 

Since rank(Mi) ^ k and rank(M 2 ) ^ k, rank(M) ^ 2k. Then A = {G t x : x G X} and B = {Me" : e" G 
F^ n } are both linear subspaces of F^ n , and dim(A) = k and dim(B) ^ 2/c. 

Let {xi,..,Xfc} denote a basis of X. Then {GtXi, .., G^Xfe} is a basis of A. Similarly, since rank(M) ^ 2/c, 
there exist 2/c vectors {yi, .., y2k} such that {Myi, .., My2k} is a subset of basis of B. 

If 3/c > An, since both ^4 and B are linear subspaces of F^ n , there exists (ai, .., a^, 61, .., 6 2 fc) 7^ (0, 0) such 
that 

^o i (G t x i ) + ^6 i (My i ) = 0. 

i=l j=\ 

If (ai,..,afc) = (0, ...,0) or (&i,..,& 2 fc) = (0, ...,0), then it contradicts the linear independence of basis. Thus, 
(ai, .., a fe ) / (0, 0) and (61, .., 6 2 fc) / 0. Then, 

k 2k 

J2 a i( G tXi) + ^b i {My i ) 
i=i j=i 

fe 2fe 

i=i j=i 

fc 2k 
i=l j=\ 

= 0. 
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Fig. 9. A single source and a single sink network : The link capacity in this network is as follows: r(h) = r(fa) = r('s) = r (^) = 
4, r(is) = ... = r(Zio) = 2. All the links in the middle layer have capacity 1. Error correction at Y3 and Y4 is necessary for achieving the 
capacity. 



Therefore, we have found nonzero x = J2i=i a i x i anc ^ ( e i) e 2) T = — 12j=i(~bjyj) such that Gtx = Me". 
It completes the proof. 



The following corollary shows that vector linear code£] (see e.g. [22]) also achieve at most rate 4/3. 
Corollary 1: For the network in Fig. [8] with a single adversarial link, a vector linear network code can achieve 
at most rate 4/3. 

Proof: For a vector linear code, the outgoing edges of each node carries vectors of alphabet symbols which 
are function of the vectors carried on the incoming edges to the node. We consider a vector linear code that groups 
m symbols into a vector. As in lemma [TJ we define the (4n)m x km transfer matrix Gt between s and t. Transfer 
matrices M\ and M2 are also defined in the same way, and rank(Mi) ^ km and rank{M2) km. As in the 
proof of lemma |7J when k > we can show that there exists vectors (x, e\, e.^) (x ^ 0) satisfying 

G t x = (Mi • ei,M 2 • e 2 ). 



B. Error correction at intermediate nodes 

We next give an example in which error correction at intermediate nodes is used for achieving the capacity. The 
intuition behind our approach is that error correction at intermediate nodes can reduce the error propagation to 
the links in the bottom layer and MDS code assigned on the bottom layer gives the correct output. We consider a 

4 A vector linear code is a linear code operating over a vector of symbols. 
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single source-destination network in Fig. [9] For a single adversarial link, upper bound from Theorem Q] is 8. From 
Sec. IV-A, the upper bound on the linear coding capacity is X^;=5 r (^)/( m + 1) = 6. 

Lemma 8: Given the network in Fig. |9j for a single adversarial link, rate 8 is achievable using error correction 
at intermediate nodes. 

Proof: Without loss of generality, all nodes except Y% and I4 forward their received information. We first 
assign a (12, 8) MDS code (a, 6, ... , I) on the bottom layer links and apply a (4,2) MDS code at each decision 
node, e.g., we assign (e, /, e + /, e + 2/) and (g, h, g + h, g + 2h) on incoming links to Y3 and I4 respectively. 
Then we can assign codewords on all links in the network since all nodes except I3 and Y4 are forwarding nodes. 
If the adversarial link is on the middle or bottom layer, at most two errors are propagated to the sink node and the 
MDS code assigned on the bottom layer gives the correct output. If the adversarial link is on the top layer, at most 
two errors are propagated to the sink node through forwarding nodes Y\, Y2, Y5, and Yq. Since at most one error 
is incoming to Y3 and Y4 respectively, the (4,2) MDS code applied at each decision node gives error-free output 
(e, /) and (g, h). Therefore, when the adversarial link is on the top layer, at most two errors are propagated to the 
sink and the (12,8) MDS code returns the correct output. 



Algorithm 1 Algorithm for error correction at intermediate nodes 

M <- N 

CS <- 

g' = G 

While |M| ^ 1 and 3i s.t. d(G',i) > 0, i G M 
M' = M - 1(0', M) 
CS' = CS U Shqi^m) 

Q' = Q' - 5j(g/ )M ) 

M = M', CS = CS'. 
endwhile 

return CS 

One possible generalization of the above intermediate node error correction is as follows. Given an acyclic 
network Q = (V,£), we use cg(s,i) and cg(i,t) denote the min-cut between the source s and i, and the min- 
cut between i and the sink t in Q, respectively. We assume that there is a fixed set of nodes iV C V such that 
cg(s,i) ^ cg(i,t) for Vi G N and error correction can be applied only at nodes in N. For instance, in Fig. |9j 
J\f = {13,14}. Let d(Q,i) = cg(s,i) — cg(i,t) denote the difference between the max-flow from s to i and the 
max-flow from i to t. 

The selection function I(Q,N) chooses a node i G iV on Q which maximizes d(Q,i). Precisely, 

I(Q,N) = argmax{<i(C/, i)}. 
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Fig. 10. A single source and a single sink network : all links on the top or middle layer have capacity one. All links on the bottom layer 
have capacity 2. In this network, coding at intermediate nodes but not error-detection and correction is necessary for achieving the capacity. 

Here is the outline of our greedy algorithm with error correction at intermediate nodes. Given an acyclic network 
Q and the set of error correction nodes N, we choose a node i = I(Q, N) that maximizes d(Q, i) on Q. Since 
cg(s,i) is the max-flow from s to i, we can find cg(s,i) paths so that each path carries one symbol from s to i. 
Likewise, we also find cg(i,t) paths from i to t. Let Siig,M) denote the subgraph composed of above paths. We 
assign a (cg(s,i),cg(i,t)) MDS code on Sj^m)- We remove Sj^g^M) from Q and add it to CS which denotes 
the union of subgraphs for which codewords are already assigned. We also remove i from N. We repeat the above 
procedure until N = or there is no node i € N such that d(Q,i) > 0. A precise description of the algorithm is 
shown in algorithm [TJ Since max-flow can be computed in polynomial-time, this algorithm is a polynomial-time 
greedy algorithm. 

C. Coding at intermediate nodes 

Here we consider an example of a single-source and single-sink network, shown in Fig. [I0l whose capacity is 
achieved using linear coding at intermediate nodes rather than nonlinear error correction or detection. For a single 
adversarial link, the upper bound obtained from Theorem Q] is 4. 

Lemma 9: Given the network in Fig. \\0\ for a single adversarial link, coding at intermediate nodes achieves the 
rate 4. 

Proof: To achieve rate 4, any four links on the top layer should carry 4 independent packets. Otherwise, 
when the adversarial link is on the top layer, source cannot transmit 4 packets reliably. Then the data processing 
inequality gives a contradiction. Similarly, any two links on the bottom layer should carry 4 independent packets. 
Since Yi is connected to at most four different nodes among (X\, .., Xq) for VI ^ i ^ 4 and all links in the middle 
layer have capacity 1, each of Y\, Y2, I3, and Y4 receives all independent information. Thus we cannot apply 
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simple error-detection or correction at Y\, Y 2 , Y3, and Y 4 . Suppose that only forwarding strategy is used on this 
network. Then we show that rate 4 is not achievable. There are six symbols on the top layer. Since we use only 
forwarding, these are forwarded to the bottom layer. Since bottom layer links have total capacity 8, there are at 
least two same symbols on the bottom layer links. This contradicts that any two links on the bottom layer should 
carry four independent information to achieve rate 4. Therefore forwarding is insufficient for achieving the rate 4 
in this network. 

Now we show that a generic linear network code, where intermediate nodes do coding, achieves rate 4. From 
ll22l Ch 19], a generic network code can be constructed with high probability by randomly choosing the global 
encoding kernels provided that the base field is sufficiently large. So a random linear network code is generic with 
high probability when q is very large. If the adversarial link is on the top or middle layer, then each capacity 2 on 
the bottom layer is equivalent to two unit capacity links. Then all links in the network have capacity one and this 
problem is reduced to the equal link capacities problem. From |4), rate 6 — 2x1 = 4 is achievable. From ll22l 
Theorem 19.32], since the min-cut between s and (Yj, Yj) is at least 4 for VI ^ i ^ j ^ 4, in a generic network 
code the global encoding kernels on any two links on the bottom layer are linearly independent and they satisfy 
the MDS property. Thus an error on the last layer can be corrected. ■ 

D. Guess-and-forward 

Here we introduce a new achievable coding strategy, guess-and-forward. In this strategy, a node receives some 
redundant information from multiple paths. If this information is inconsistent, the node guesses which of its upstream 
links controlled by the adversary and forwards its guess to the sink. The sink receives additional information allowing 
it to test the hypothesis of the guessing node and correctly identify one or more adversarial links. Altogether a 
finite number of guesses are forwarded, so the average overhead of forwarding guesses goes to zero asymptotically 
with the total amount of information communicated. 

To provide intuition, we first describe a simple version of the guess-and-forward scheme on a particular four-node 
network example shown in Fig. [TT] From Theorem [1] when z = 2, the capacity is upper bounded by 7. We will 
show that rate 7 is achievable in this network using the guess-and-forward scheme. 

In this scheme, node A forwards its received information to node B and on multiple links to the sink node t. 
This information is received reliably by the sink, but not necessarily by B since the single feedback link from A to 
B may be adversarial. Node B also receives reliably from the source node s the information that was sent from s 
to A, and compares this with the information forwarded by A. A mismatch indicates that either the feedback link 
(A, B) is adversarial or that one or more links from s to A are adversarial. B sends this guess to the sink along 
with the information received on link (A,B), which allows the sink to distinguish between the two possibilities. 
Note that decoding at the sink relies on knowledge of the network and code, while the guessing node simply has 
to compare the feedback with the corresponding information forwarded from the source node. 
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Fig. 11. Four node acyclic networks: this network consists of 3 links of capacity 2 from s to A, 5 links of capacity 1 from B to t, 1 links 
of capacity 6 from A to B. Given the cut ({s, B}, {A, t}), unbounded reliable communication is allowed from source s to its neighbor B 
on one side of the cut and from node A to sink t on the other side of the cut, respectively. 

To be precise, let W and W denote the symbols sent by s and received by A respectively on the links from s 
to A. W is sent reliably from s to B, and W is sent reliably from A to t. 

In each round, s and B together send a (11, 7) MDS code to A and t across the cut cut({s, B}, {A, t}). Since 
the feedback link has capacity 6, A sends its codeword symbols W to B along feedback link I. For feedback link 
I, let Pi denote the information received by B on I. B compares Pi with W which is received from s. If Pi ^ W, 
then B obtains a guess X\ identifying the locations of adversarial links between s and A assuming Pi is reliable. 
B sends the claim (Xi,Pi) to t along each link between B and t using repetition code. If Pi = W, B does not 
send any claim. B sends claims only when it guesses at least one adversarial forward link which is different from 
those guessed in previous rounds. Thus B sends claims in 3 rounds, which is equal to the number of links between 
s and A. Note that on a result the number of channel uses is not constant in each round. Since the total number of 
channel uses required to send claims is finite, the overhead amortized over a large number of rounds goes to zero 
asymptotically with the number of rounds. 

Lemma 10: Given the network in Fig. [TT] rate 7 is achievable. 

Proof: Since there are 5 ^ 2z + 1 links from B to t, any claim (Xi,P{) can be sent reliably from B to t using 
a repetition code. 

Case 1) the sink receives some claim (X/,P/). 

The sink compares P\ with W which is received from A reliably. If P; ^ W, then the feedback link transmitting 
Pi is adversarial and the sink ignores it. Otherwise, P; is reliable. Since the claim is sent, the sink knows that 
Pi = W 7^ W and that guess Xi is correct. Thus the sink identifies the forward links in Xi as adversarial, which 
are subsequently ignored. 



21 



Case 2) no claims are sent. 

In this case, we show that the correct output is achieved. No claims are sent only if either 

• B receives W on the feedback link, or 

• the guessed set X\ only contains forward links that have been guessed by I in previous rounds. From these 
previous rounds, by case 1, the sink has already identified as adversarial either / or the guessed forward links, 
and is concerned only with the remaining network. 

Either way, there are the following two possibilities for the overall remaining network (recall that A transmits W 
to B): 

(I) all links between s and A and the feedback link are uncorrupted. 

(II) some links between s and A are corrupted and feedback link is corrupted such that feedback link transmits 
error-free output. 

In possibility (I), the feedback link transmits W to B. In (II), A sends W ^ W but the feedback link changes it 
to W so that B does not send any claims. We first consider all sets of 7 forward links on the cut. There are (®) = 8 
such sets of links. Each set has total capacity at least 9. For each such set L, the sink checks the consistency of 
the output of rate 7 obtained from L. We also consider all sets of 6 links such that each set includes all 3 links 
between s and A and any 3 links between B and t. There are (jj) such sets. The sink also checks the consistency 
of the output of rate 7 for each set. 

Case 2 - a) there is no set of 7 links giving consistent output. 

In this case, there are more than 1 forward adversarial link on the cut. Since z = 2, all two adversarial links are 
forward links and thus possibility (II) cannot hold. Then possibility (I) is true and there are at most two forward 
adversarial links with capacity 1 on the cut. We obtain the correct answer from our (11,7) MDS code. 

Case 2 - b) there is no set of 6 links that includes all 3 links from s to A and gives consistent output. 

In this case, possibility (II) is true. Then there is at most one forward adversarial link on the cut. We obtain the 
correct answer from our (11,7) MDS code. 

Case 2 - c) There exist both a 7-link set L\ giving consistent output and a 6-link set L2 that includes all 3 links 
between s and A and give consistent output. 

It is clear that YlheL^L r (h) ^ 7 for any L\ and L2. Thus L\ and L2 give the same consistent output. Since 
at least one of (I) and (II) is true, this output is correct. 

From cases 1-2, since z = 2, B needs to send claims at most 2 times to obtain the correct output. ■ 

V. GUESS-AND-FORWARD ON SOME FAMILIES OF NETWORKS 

In this section, we employ the guess-and-forward strategy on a sequence of increasingly complex network families. 
The first is a two-node network with multiple feedback links. The second is a four-node acyclic network. The third 
is a family of 'zig-zag' networks. In the first two cases, the guess-and-forward strategy achieves the capacity. For 
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Fig. 12. two-node network Q with n forward links and m feedback links. 

zig-zag networks, we derive the achievable rate of guess-and-forward strategy and present conditions under which 
this bound is tight. 

A. Two-node network 

We achieve the error-correction capacity of the two-node network with multiple feedback links by using guess- 
and-forward strategy. A two-node network shown in Fig. [12] is composed of n forward links with arbitrary capacity 
and m feedback links with arbitrary capacity. In Lemma [TT] we first characterize the capacity of this network when 
each forward link has capacity 1. We extend this result to Theorem [2] when each forward link has arbitrary capacity. 

Lemma 11: Consider the two-node network shown in Fig. [12] such that each forward link has capacity 1. Let C 
denote the error-correction capacity with z adversarial links. If n ^ 2z, C = 0. Otherwise, C = min{n — z, n — 
2(z-m)}. 
Proof: 

From lemma [2] in Section [TTlJ upper bound of the capacity is min{ra — z, n — 2(z — m)} when n > 2z, and 
otherwise. So it is sufficient to prove the achievability of this upper bound by applying our guess-and-forward 
strategy when n > 2z. 

Case 1) m < f . 

Step 1) In each round, the source s sends an (n,n — 2{z — m)) MDS code on the n forward links. Since 
m ^ z/2, n — 2(z — m) ^ n — z. Thus for any received n signals, there exist n — 2{z — m) uncorrupted signals. 
If all ( n _ 2 (™_ jn )) subsets of received symbols decode to the same message, this message is correct. Otherwise, the 
sink sends the n received signals to the source s on each feedback link using a repetition code. 

Step 2) Based on the received information on each feedback link, the source tries to identify the bad forward 
links. Thus, for each feedback link, the source obtains a claim regarding the location of forward adversarial links 
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which is correct if that feedback link is not adversarial. 

Step 3) This step consists of m phases, each composed of a finite number of rounds. In the ith phase, the source 
sends the claim obtained from the ith feedback link together with what it received on that feedback link to the sink. 
This information can be sent reliably to the sink using a repetition code because n — 2z > 0. If what the source 
received matches what the sink sent, the ith feedback link was not corrupted and the associated claim is correct. 
Using this claim, the sink can decode the message as well as identify at least one of the forward adversarial links. 
If all m feedback links were corrupted, the sink knows that there are only z — m forward adversarial links and 
since we are using a (n, n — 2(z — m)) MDS code the message is correctly decodable at the sink. 

Note that we only need to use the above scheme during the first 2m times the sink sees inconsistency at step 1 . 
The reason is that from steps 1-3, the sink either figures out that all feedback links are adversarial or identifies at 
least one forward adversarial link. If all feedback links are bad, they are ignored and the (n, n — 2{z — m)) MDS 
code gives us the correct output. If there are k ^ 2m forward adversarial links, after the first k times the sink sees 
inconsistency at step 1 , all forward adversarial links are identified subsequently and no further inconsistency is seen 
among the remaining forward links. Otherwise, when there are more than 2m adversarial links, the sink finds 2m 
forward adversarial links and ignores them. Then from @, the rate n — 2m — 2{z — 2m) = n — 2{z — m) can be 
achieved using the remaining forward links only. 

Case 2) m > |. 

In each round, the source s sends an (n,n — z) MDS code on the n forward links. For any received n signals, there 
exist n — z uncorrupted signals. If all ( " ) subsets of received symbols decode to the same message, this message 
is correct. As in the case 2-a, from steps 2-3, the sink either concludes that all feedback links are adversarial or 
identifies at least one forward adversarial link. If all m feedback links were corrupted, there are only z — m < z/2 
bad forward links and subsequently only the forward links are used to achieve the rate n — z. Otherwise, the above 
scheme is used at most z times inconsistency is seen at step 1, after which the sink has identified all bad forward 
links and the remaining forward links suffice to achieve rate n — z. ■ 

Now we generalize above result to the general case when each forward link has also arbitrary capacity. 

Theorem 2: Consider the two-node network shown in Fig. [12] with arbitrary link capacities. Let D p denote the 
sum of the p smallest forward link capacities. The error-correction capacity is 

f if n ^ 2z 

C={ 

[ mm{D n _ 2 ,D n _ 2 (^ m )+} if n > 2z 
Proof: From lemma |2j achievable capacity is when n ^ 2z. When n > 2z, we use D to denote the sum 
of all n forward link capacities. For achievability, when m ^ z/2, the source sends (D,D n _ z ) MDS code to the 
sink. When m > z/2, the source sends (D, -D n -2(z-m)+) MDS code to the sink. By using the same strategy as in 
the proof of Lemma [TT] we can achieve the rate C. 
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Fig. 13. Four node acyclic networks: unbounded reliable communication is allowed from source s to its neighbor B and from node A to 
sink t, respectively. This network consists of a links of arbitrary capacity from s to A, b links of arbitrary capacity from B to t. From A 
to B, there are m feedback links and each feedback link has the minimum capacity. 

B. Four-node acyclic network 

In this section, we use the guess-and-forward strategy on a four-node acyclic network, the simplest case of a 
zigzag network. In this acyclic network, source node s and its neighbor node B lie on one side of a cut that separates 
them from sink node t an its neighbor A. As in the cut-set model, we allow unbounded reliable communication 
from source s to its neighbor B on one side of the cut and from node A to the sink t on the other side of the cut; 
this allows node B to compare information from feedback links with uncorrupted information from the source to 
obtain the guess. Similarly, by comparing claims with information reliably transmitted from node A, the sink can 
identify the corrupted link. 

This network is composed of a set of a forward links {h,..,l a } with arbitrary capacities from s to A, a set of b 
forward links {l a +i, ••, l a +b} with arbitrary capacities from B to sink t, and a set of m feedback links from A to B. 
Each feedback link has capacity h whose value will be derived in following Section FV-B 1 1 C\ = Y^ieth i ) r (0 
and C2 = Y2ie(l +1 l +&) r (^) denotes the sum of forward link capacities from s to A, and from B to t, respectively. 
Let C = C\ + C2. C z is the upper bound on this network obtained from Theorem [T] 

In |2T1 . we have shown that rate C z is asymptotically achievable on this four-node acyclic network when each 
feedback link has capacity at least C\. Here we show that rate C z is achievable even when each feedback link 
has smaller capacity than C\. In Section I V-B 1 1 we first consider a coding strategy at node A and formulate a 
linear optimization problem which gives the minimum capacity of each feedback link that guarantees the success 
of our strategy. Then, in Section IV-B2I we show that rate C z is asymptotically achievable this smaller feedback 
link capacity using our guess-and-forward strategy. 
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Fig. 14. Four node acyclic networks: (a) z — 2 and feedback link transmits (ai + ai, b\ + 62, ci + C2). (b) 2 = 3. Assume that (01, .., a&), 
(bi,..,ba), (ci,.., C4), (di, .., di), and (ei,e2,e3) are transmitted on forward links (Zi,.., Z5) from s to A, respectively. Feedback link 
transmits (E- =1 «i, ELi Ei=i Ei=i ELi e 0- 

1 ) Coding strategy at node A: Suppose that (s, B) sends (C, C z ) MDS code across the cut to (A, t). We consider 
the encoding strategy at node A and derive the minimum capacity of each feedback link. Suppose that node A 
receives the vector of symbols W = {W k , . . . , Wi a ) from s where W\ = {pj, . . . ,Pi ) denotes the codewords on 
link I £ {li, . . . , la}. We first assume that node A transmits, on each feedback link to B, the same set of codewords 
each of which is a linear combination of codewords received on a single link from s to A. Precisely, for any forward 
link li, node A transmits on each feedback link g(Wi} = (gj. (WiJ, . . . , gf' (WjJ) where gj {Wi} is a single linear 
combination of W\ z = {pj,, )• Thus, the same value giW) = {g{Wi 1 ), .., g{Wi a )) is transmitted on each 

feedback link. For instance, given a network in Fig. fllT a). A transmits g{W) = {g{WiA, g{Wi 2 ), g{Wi 3 )) where 
g(W k ) = 01 + o 2 , g{W h ) = h + b 2 , and g{W h ) = c\ + c 2 . 

Here, we define the degree of freedom of forward link I between s and A as follows. 

Definition 3: Consider the vector of symbols W\ received on forward link / from s to A and assume that node 
A transmits k linear combinations of Wi, g{Wi) = {gj{Wi), . . . ,gf{W{)). Let Mi denote the r{l) x k encoding 
matrix at A for link I such that Wi ■ Mi = g{W{). Then the degree of freedom of link /, f{l), is defined as the 
capacity of link / minus the rank of the matrix Mj, i.e., f{l) = r{l) — rank{M{). For any forward link I between 
B and t, we simply define the degree of freedom f{l) as the link capacity, i.e., /(/) = r{l). 

For example, in Fig. fllT a). since feedback link transmits {a\ + a 2 ,b\ + b2,c\ + oi), f{l) = 1 for all forward 
links from s to A. In Fig. HUb), since feedback link transmits (YX=1 a ^ X^Li Y^i=i ^ Z)i=i <k> 12i=i e i)> 
/(ii) = f{h) = 5, /(/ 3 ) = f{k) = 3, and /(Z 5 ) = 2. 
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From the definition of degree of freedom, node A sends 

h= £ wo - m) = a - /(o (3) 

ie{h,..,L} ie{h,..,la} 
codewords to B along each feedback link. 

Now we introduce our coding strategy at node A as follows. 

Node A can choose any g(W) which satisfies the following two conditions on the degree of freedom of links. 
Condition 1: Given any set A\ composed of 2z forward links, X^zgAi /(0 ^ C — C z . 

Condition 2: Given any set A2 composed of z forward links and ^3 composed of z — m forward links such that 

A 2 n A 3 = 0, EieA 2 /(0 + EieA 3 KO < C - C z . 

Condition [T] means that the sum of the degree of freedom of any 2z forward links are less than or equal to C — C z . 
Condition |2] means that the sum of the degree of freedom of any z links plus the sum of any z — m link capacities is 
less than or equal to C — C z . In the proof of Lemma [T3l and [141 we show that these two conditions are necessary to 
prove the tightness of our upper bound in Theorem Q] For example network in Fig. (Ha), z = 2 and the upper bound 
C z = 6. 3 codewords sent by A satisfies above two conditions, and feedback capacity 3 is sufficient. Likewise, 
when z = 3 and the upper bound C z = 9 in the network Fig. [147 b). 5 codewords sent by A also satisfies above 
two conditions. In [21], the minimum required capacity for each feedback link to achieve rate C z is the sum of all 
forward link capacities between s and A, which is 6 and 23 for the networks in Fig. [PiT a) and (b), respectively. 

Finally, we formulate a linear optimization problem which gives the minimum capacity of each feedback link, 
based on conditions [T] and [2] 

a 

min h = Ci-^2 

i=i 

f(k)^r(k), Vl^i^a + b 

£ f(l) ^C-C z , M C £, \M\ ^ 2z (4) 

iGNi l£N 2 

N 1: N 2 cS,\Ni\ ^z-m,\N 2 \ ^ z,N 1 nN 2 = $ 
Objective function h is defined in equation ([3]). The first inequality constraint is the link capacity constraint. 
The second and third constraints come from condition [T] and [2j respectively. We can check that solving the above 
optimization problem for the networks in Fig. [14T a) and (b) gives the feedback link capacities 3 and 5, respectively. 

2) Guess-and-forward strategy: In this section, we show the tightness of the upper bound using our guess-and- 
forward strategy. Our proof of decoding success requires each feedback link's capacity to satisfy the lower bound 
obtained in d4}, so that node B receives sufficient feedback information to guess the corrupted links by comparing 
with information reliably received from the source. This feedback link capacity can in general be smaller than that 
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in the simple example of Section I V-B 1 1 so the details and proof of correctness of the scheme are slightly more 
involved. 

The guess-and-forward strategy achieving the rate C z for the four-node acyclic network shown in Fig. [13] is as 
follows. In each round, s and B together send a (C,C Z ) MDS coddj, obtained from Lemma [T2l below, to A and 
t across the cut cut({s, B}, {A, t}). Let W and W denote the codewords s sends to A, and A received from s, 
respectively. Using the coding strategy in Section |V-B1[ A sends g(W) to B along each feedback link using a 
repetition code. For each feedback link I, let Pi denote the information received by B on I. B compares Pi with 
g(W). If Pi 7^ g(W), then B obtains a guess Xi identifying the locations of adversarial links between s and A 
assuming P; is reliable. B does not send any claim if Pi = g(W), or if the guessed set Xi only contains forward 
links that have been guessed by I in previous rounds. 

We next show that this strategy achieves rate C z asymptotically, via the following series of lemmas. 

Lemma 12: Given the four-node acyclic network in Fig. [T3] let u denote the sum of 2z largest degree of freedom 
of links in the network. Suppose the adversary introduces errors on z forward links subject to the constraint that the 
values sent along the feedback links are unaffected. There exists a (C, C — u) generic linear code for the forward 
links that corrects these z error links. 

Proof: See the appendix. ■ 

Since the sum of 2z largest degree of freedom is at most C — C z from the condition [T] we obtain C — u ^ C z . 

Definition 4: Given a set of any k forward links L = {Zi, . . . , Zfc} in the four-node acyclic network, we say L 
gives consistent output if 2~2i£L r (0 ^ C z and the decoded output from any C z code symbols on L is the same. 

Lemma 13: Given the four-node network in Fig. [13] such that b ^ 2z + 1, rate C z is achievable. 

Proof: Since b ^ 2z + 1, any claim (X[,Pi) can be sent reliably from B to t using a repetition code. The 
details of proof is presented in the appendix. ■ 

Lemma 14: Given the four-node network in Fig. [13] such that b ^ 2z, rate C z is achievable. 

Proof: When b ^ 2z, reliable transmission of claims from B to t is not guaranteed. Thus we cannot use the 
same technique used in the proof of Lemma [13] The proof is presented in the appendix. ■ 

C. zig-zag network 

In this section, we consider a special case of the zig-zag network, the non-overlapping zig-zag network. We 
present conditions under which our upper bound is tight and derive a general achievable bound for non-overlapping 
zig-zag network. 

We call the network shown in Fig. [15] a fc-layer non-overlapping zig-zag network. Unlike the general zig-zag 
network, feedback transmission is only possible from A\ to B{. A4 and Bi can communicate reliably with unbounded 
rate to A^i and -B;+i, respectivley. (s = Bq, t = Ak + x). Thus, reliable transmission with unbounded rate is possible 
from Ai to Aj, and from Bi to Bj for Vi < j. We use F{ and W{ to denote the set of forward links and feedback 

5 A generic linear code is MDS. 
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Fig. 15. fc-layer non-overlapping zig-zag network: Given the cut cut({s, B\ , .., Bk}, {Ai , .., Ak,t}), Ai and Bi can communicate reliably 
with unbounded rate to A i+l and B i+ i, respectively.(s = Bq, t = Ak+i). The links from Ai to Bi represent feedback across the cut. This 
model more accurately captures the behavior of any cut with k feedback links across the cut. 

links from £?i_i to A4, and from Ai to Bi, respectively. Let \Fi\ = bi and \Wi\ = mi. In this network, we assume 
that each feedback link from Ai to Bi has a sufficient capacity to forward all the information Ai received from 
It is clear that the four-node network is 1 -layer non-overlapping zig-zag network. Given a fc-layer zig-zag 
network Q, we use C z to denote the upper bound on Q obtained from Theorem Q] 

Now we consider the following strategy for non-overlapping zig-zag network which is similar to that for a 
four-node network. We use C to denote the sum of all forward link capacities. 

In each round, s and (Bi,..,Bk) together send a (C,C Z ) MDS code to (A\,..,Ak) and t across the cut 
cut({s, B\, .., -Bfc}, {Ai, .., A*., i}). For 1 ^ i ^ k, Ai sends its codeword symbols W to Bi along each feedback 
link using a repetition code. For each feedback link I, let P; denote the information received by Bi on /. Bi 
compares Pi with W which is received from s. If Pi ^ W, then Bi obtains a guess Xi identifying the locations of 
adversarial links between and Ai assuming Pi is reliable. Bi sends claim (Xi,P{) to Ai + \ along each link 
using repetition code. If Pi = W, Bi does not obtain any claim. For all 2 ^ j ^ k, Aj sends any received claim 
from Bj_i to the sink reliably. The above strategy is applied in each round. Bi sends claims only when Xi guesses 
at least one adversarial forward link which is different from forward links guessed by / at previous rounds. 

For a four-node acyclic network in Fig. |T3j Lemma [T3l shows that our bound is tight when claims are sent reliably 
from node B to the sink t, i.e., b ^ 22 + 1. Using our strategy, we simply extend this result for the non-overlapping 
zig-zag network as follows. 

Lemma 15: Given a family of /c-layer non-overlapping zig-zag networks such that bi ^ 2z + 1 for 2 ^ i ^ k + 1, 
rate C z is achievable. 

Proof: Since 6, ^ 2z + 1 for 2 ^ i ^ k + 1, any claim (Xi,Pi) can be sent reliably from B, L -\ to Ai using 
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a repetition code. Then Aj sends this claim reliably to sink t. As in the proof of Lemma [T3J we first show that 
at least one adversarial link is removed whenever sink receives some claim, in case 1. We also show that correct 
output is always achievable when no claims are sent in case 2. 
Case 1) sink receives some claim pQ,Pj). 

Assume that feedback link I is between Aj and Bj, and Bj sends this claim to Aj + \. In this case, we use the 
same strategy as in the case 1 in Lemma [13] Then we show that the sink removes at least one bad link whenever 
it receives claim. 

Case 2) no claims are sent to the sink. 

Similar to the case 2 in the proof of Lemma [T3l the case that no claims are sent to the sink occurs only when 
for each feedback link I between Aj and Bj either of the following holds: 

• the information Bj receives on I is equal to W where W is the uncorrupted codeword sent by s to Bj 

• the guessed set X\ only contains forward links that have been guessed by I in previous rounds. From these 
previous rounds, by case 1, the sink has already identified as adversarial either / or the guessed forward links, 
and is concerned only with the remaining network. 

Either way, there are the following two possibilities for the overall remaining network (recall that Aj transmits W 
to Bj). 

a) All forward links in (Fi,..,Fk) and feedback links in {W\,..,Wk) are not corrupted. 

b) For some {ii,..,i p } C {1,2,.., k} such that + .. + m !p ^ z, all feedback links in (W^,.., W% ) are 
corrupted and some forward links in (F^, .., Fi p ) are corrupted. The furthest downstream forward links in F^+i 
can be also corrupted. For Vj ^ .., i p , k + 1}, links in Fj and Wj are not corrupted. 

Let N = {(i i, .., i p )\l %\ < .., < i p k, TOjj + .. + m,j p s% z}U{0}. (Note that {0} corresponds to the possibility 
in a)). From a) and b), there are total \N\ possibilities. Exactly only one of them is true. Now we describe how 
the correct solution with rate C z can be obtained. We check the consistency of the output for each possibility. For 
each (ii,..,i p ) 6 N, we first remove + .. + rrii p corresponding feedback links and check whether there are 
K — [z — (mjj + .. + mi )) forward links giving consistent output such that remaining (z — (m^ + .. + mi )) 
forward links are elements of F^ U .. U Fj p U F^+i- If such a set exists, we denote it by G(i\, ..,i p ). If there is no 
such set of K — (z — (m^ + .. + mi p )) forward links giving consistency, we remove .., i p ) from N and ignore 
corresponding possibilities. 

Now we show that only tuples (ii,..,i p ) such that G(i\,..,i p ) gives the correct output remain in N. Since at 
least one remaining tuple gives the correct output, it is sufficient to prove that for any remaining ..,i p ) G N 
and (ji, ..,jr) G N, G(i\, ..,i p ) and G(j\, .., j r ) gives the same output. This is equivalent to showing that the sum 
of capacities of forward links which are contained in both G(i±, ..,i p ) and G(ji, ..,>) is at least C z , i.e., 

leG(i 1> .. > i p )r\G(j 1 ,..,j r ) 
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Fig. 16. Reduced non-overlapping zig-zag network Q' such that m u > z and b u +\ ^ 2z + 1, . . . , b^ + i 2z + 1. This graph is obtained 
from Q by erasing all feedback links in W\ U W2 . . . U W u -i. 

G(ii,..,i p ) gives if — (z — (m^ + .. + mj )) forward links giving consistent output such that remaining [z— (mi 1 + 
.. + rrii p )) forward links are in i 7 ^ U .. UFj p UFfc +1 . Similarly, G(ji,..,j r ) gives K — (z — (rrij 1 + .. + rrij r )) forward 
links giving consistent output such that remaining (z — (rrij 1 + .. + rrij r )) forward links are in Fj 1 U .. U Fj r U -Ffc+i- 
In this case, from the definition of cut-set upper bound in Lemma [6) the sum of the capacities of forward links 
assumed to be correct by both G(i%, ..,i p ) and G(ji, ..,j r ) is at least C z . Since each guess gives consistent output, 
these two guesses gives the same output. Since any two remaining guesses in N give the same consistent output, 
all remaining guesses give the same output. ■ 
We derive another condition under which our bound is tight. 

Lemma 16: Given a family of fc-layer non-overlapping zig-zag networks such that m u > z and bj ^ 2z + 1 
V j ^ u + 1 for any 1 ^ u ^ k, rate C z is achievable. 

Proof: We consider a reduced non-overlapping zig-zag network Q' shown in Fig. [16] which is obtained from 
a given fc-layer non-overlapping zig-zag network by erasing mi + .. + m u -\ feedback links W\ U .. U W u -\. We 
use C' z to denote the upper bound on Q' from Theorem Q] Since Q' is weaker than Q, it is sufficient to show that 
C' z ^ C z and C' z is achievable on Q' . 

Step 1) We show that C z < C' z . 

We first compute C' z on Q' from Theorem [T] Suppose that C' z is obtained by choosing and A* = {A^, ..,Ai } C 
and 5* = {Aj 17 ..,Aj r } C {^4 U+1 , ..,.Afc} — A* and applying Lemma |6] after erasing k forward links 
set F*, m feedback links set W*. It is sufficient to prove that choosing the same F*, W*, A*, and B* on original 
graph Q gives the same upper bound C' z . 

Since m u > z, A u A* and A u B* from the definition of upper bound in Lemma [6] Then Pa* ^ Fa h U .. U 
F Ap C U . . . U F k , P B . C F A . t U .. U F Ajr C U . . . U F k . 
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Since m u > z and > z, no matter what W* is erased on Q', chosen downstream links Ra* and Rb* are 
in F u+1 U..U4 i.e., R A , , R B * € F u+1 U . . . U F k . 

Thus, Z A . = Pa- U C U .. U F fc and Z B , = P B . U fl fl , C U .. U F k . 

Since all erased forward links in Za* U Zb* are in U .. U F k for erasing the same F* , W* , Za-, and 
Zb* on original graph Q also gives the same upper bound C' z for Q. Since C 2 is the minimal upper bound for Q, 

c z ^ a z . 

Step 2) We show that rate C z is achievable. 

From Lemma Q3] since b u+ i ^ 2z + 1, . . . , bk+i ^ 2z + I and C 2 ^ C' z , rate C 2 is achievable on Q' . Thus, 
given a non-overlapping zig-zag network Q, we first ignore all feedback links between Ai and E>i (1 ^ i ^ it — 1) 
and apply the same achievable strategy for 

From steps 1) and 2), we complete the proof. ■ 

Now we derive an achievable rate of guess-and-forward strategy for any non-overlapping zig-zag network. 

We use Qj to denote the non-overlapping zig-zag network obtained from original Q by erasing all feedback links 
in Wi such that i £ I. Let b(i,j) = Ylu=i+i denote the number of forward links between % th layer and jth 
layer. Supersets P, Q, and R are defined as follows. 

P = {{»}|1 < i < A;}, 

Q = {{ii,.;i u }\{h,~,iu} C {1, ..,£}, 6(1, ii) > 22 + 1, 

6(»i, ta) > 2z + 1, .., 6(i u , fc + 1) ^ 2z + 1}, 
i? = {{h,.., i u }\{h,--, iu} C {1, .., k}, m» 1 > s, 

6(ii, i 2 ) > 2z + 1, .., 6(i u , fc + 1) ^ 2z + 1}. 

Lemma 17: Given the network in Fig. [15] rate max/ e puQuil C/ is achievable. 

Proof: We first show that rate C{;} is achievable for 1 ^ z ^ fc. We ignore all feedback links except the 
feedback links in Wj. Then applying the same achievability strategy for four-node acyclic network gives the rate 
C{j} from Lemma [13] and [Q] 

For any subset I G Q, we ignore all feedback links except the feedback links in Wi such that i E I. Then from 
Lemma [15] rate Cj is achievable. Similarly, for any subset I £ R, rate Cj is achievable from Lemma [16] This 
completes the proof. 

■ 

VI. Conclusion 

We have studied the capacity of single-source single-sink noiseless networks under adversarial attack on no more 
than z edges. In this work, we have allowed arbitrary link capacities, unlike prior papers. We have proposed a new 
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cut-set upper bound for the error-correction capacity for general acyclic networks. This bound tightens previous cut- 
set upper bounds. For example networks where the bounds are tight, we have employed both linear and nonlinear 
coding strategies to achieve the capacity. We have proved the insufficiency of linear network codes to achieve the 
capacity in general. We also have shown by examples that there exist single-source and single-sink networks for 
which intermediate nodes must perform coding, nonlinear error detection or error correction in order to achieve 
the network capacity. This is unlike the equal link capacity case, where coding only at the source suffices to 
achieve the capacity of any single-source and single-sink network. We have introduced a new achievable strategy, 
guess-and-forward, which is used to show the capacity of the two-node network and a family of four-node acyclic 
networks. Finally, for a class of so called non-overlapping zig-zag networks, we have derived the rate achieved by 
guess-and-forward and presented conditions under which that bound is tight. 

Further work includes characterizing the capacity region of a four-node acyclic network when the capacity of 
feedback links is small. When the lower bound on the feedback link capacity is not satisfied, we can investigate also 
the tightness of our bound or find an achievable capacity region. It would also be interesting to find new achievable 
strategies and upper bounds for more general zig-zag and other networks, particularly since cut-set approaches are 
not sufficient in general ll20l . Investigating networks for which there exists a gap between known upper and lower 
bounds may provide further insights. Another related problem, which we treat briefly in our conference paper ifTTl , 
considers high-probability correction of errors in a causal adversary model as in lfT5l . 

Appendix 

Proof of Lemma |72] : Since the adversary controls forward links such that codewords on feedback links are 
unchanged, from the definition |3l the degree of freedom of errors that the adversary can control for any forward 
link I is at most f(l). We prove this lemma by simply extending [4, Theorem 4] which is for the equal link 
capacities case to the unequal link capacities case. 

Let M denote the transfer matrix whose columns are the coding vectors assigned to links. Then, the difference 
set is 

A(V,s) 

= {(0,(e) - 0z(e')) • M- 1 : I G T + (t),N(e) ^ z,N(e') ^ z} 
= {9i(e - e') • M _1 : / G T + (t),N(e) ^ z, N(e') ^ z} 
= {61(d) ■ M- 1 : I G r + (t), N(d) ^ 2z}, 

where N(e) denotes the number of links error e occurs and 61(e) denotes the output of error vector e at the sink 
with zero-input. 

Last equality comes from {e - e' : N(e) < z,N(e') ^ z} = {d : N(d) ^ 2z}. 
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We use p to denote the maximum number of different error vectors when the adversary controls 2z links. Since 

A(V,z) = {0 l (d)-M- 1 :leT + (t),N(d) ^2z}, 

iA(^)K P .f;( a + 6 ). 

Since u is the sum of 2z largest degree of freedom, p ^ (q — l) u . Thus, 

|A(v,*)| < { q -ir^( a + h )<2 c { q -iY, 

where C is the sum of all forward link capacities. 

After computing the size of the difference set A(V,z), we apply exactly the same argument as in [4, Theorem 
4]. From the argument in the proof of @ Theorem 4], it is sufficient to show the existence of u x C parity check 
matrix H such that for all w £ A*(V, z), Hw T ^ where A*(V, z) = A(V, z) — {0}. By using the same technique 
in (31 Theorem 4], the number of matrices H such that there exists w G A*(V,z) satisfying Hw T = is upper 
bounded by 

q ^-V(q-l)-\A(V,z)-l) 
< 2 C q< n - V >{q-l)- 1 {q-l) u 

2 C q un 
1 

Thus, if q is a prime power such that q > 2 C , then there must exist a u x C matrix such that Hw T ^ for all 
w € A*(V, z) and the result follows. 
Proof of Lemma : 

Since b ^ 2z + 1, any claim (Xi, Pi) can be sent reliably from B to t using a repetition code. In case 1, we first 
show that at least one adversarial link is removed whenever sink receives some claim. In case 2, we show that rate 
C z is achievable even when no claims are sent from B. 

Case 1) sink receives some claim 

The sink compares Pj with g(W) which is received from A reliably. If Pj ^ g(W), then feedback link transmitting 
Pi is adversarial and the sink ignores it. Otherwise, Pj is reliable. Since the claim is sent, the sink knows that 
Pi = 9(W) 7^ g{W) and that guess is correct. Thus the sink identifies as adversarial the links in Xi, which are 
subsequently ignored. Therefore, in this case, the sink removes at least one bad link whenever B sends claims. 

Case 2) no claims are sent. 

From our strategy, the case that no claims are sent from B occurs only when for each feedback link / either of 
the following holds: 

• the information B receives on I is equal to g(W) where W is the uncorrupted codeword sent by s to B 
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• the guessed set X\ only contains forward links that have been guessed by I in previous rounds. From these 
previous rounds, by case 1, the sink has already identified as adversarial either I or the guessed forward links, 
and is concerned only with the remaining network. 

Either way, there are the following three possibilities for the overall remaining network (recall that A transmits W 

to B). 

(I) All links between s and A and all feedback links are uncorrupted. Then W = W and g(W) is reliably 
transmitted. 

(II) Some links between s and A are corrupted so that A receives g(W) ^ g(W) from s, but the adversary 
controls all feedback links such that each feedback link changes g(W) to g(W). 

(III) Some links between s and A are corrupted such that codewords A sends along each feedback link are 
unchanged, i.e., W ^ W and g(W) = g(W). All feedback links are reliable and B receives g(W). 

If possibility (I) is true, all links between s and A and all feedback links are uncorrupted. Then there exists a set 
of (a + b — z) forward links on the cut such that this set includes all a links between s and A and some b — z links 
between B and t, and gives consistent output with rate C z . (Note that the sum of capacities of any (a + b — z) 
forward links is larger than or equal to C z from the definition of our bound in Theorem [TJ) If possibility (II) is 
true, all m feedback links are corrupted. Then there exist a set of (a + b — z + m) forward links on the cut that 
gives consistent output with rate C z . If possibility (III) is true, then we obtain the correct output from (C, C z ) MDS 
code in Lemma [121 

Based on the above analysis, we give the following simple decoding algorithm and prove the correctness of this 
algorithm as follows. 

Algorithm 2 Decoding algorithm for achieving rate C z when no claims are sent. 

IF there is a set L\ which is composed of a + b — z + m forward links and gives consistent output, 

THEN the output with rate C z from L\ is correct. 
ELSE IF there is a set L2 which is composed of all a forward links from s to A and some b — z forward links 
from B to t, and gives consistent output, 

THEN the output with rate C z from L2 is correct. 
ELSE the output with rate C z obtained from (C, C z ) MDS code is correct. 

END IF 

Case 2 - a) there is a set L\ composed of (a + b — z + m) forward links giving consistent output. 

In this case, we show that output with rate C z obtained from L\ is correct. First we prove that output from L\ 
is correct when (II) or (III) is true. If (II) is true, all m feedback links are corrupted and thus L\ contains at least 
(a + b — z + m) — (z — m) = a + b — 2(z — m) uncorrupted links. From the definition of our upper bound in 
Lemma |5J the sum of capacities of any a + b — 2(z — m) forward links is larger than or equal to C z . Since L\ gives 
consistent output, the output is correct. If (III) is true, L\ contains at most z corrupted links. In this case, we can 
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show that L\ gives correct output using condition [2 Since (III) is true and the values on feedback links remain the 
same, when adversary controls a set of z forward links, A\, the degree of freedom adversary can control is at most 
X^eAi /(0 0-^1 1 = z )- F rom condition[2j the sum of degree of freedom of z links in A\ plus the sum of capacities 
of z — m forward links not included in L\ is less than or equal to C z , i.e., YlieAi f(l) + Y^ieS-Li r (0 ^ ^ ~ ^z- 
Therefore, L\ contains at least rate C — (C — C z ) = C z uncorrupted output and the output is correct. As shown 
above, using condition |2l we have shown that L\ contains at least one correct output if (III) is true and complete 
the proof from the consistency of L\. 

Case 2 - a - i) there is no set of (a + b — z) links that includes all a forward links from s to A and gives 
consistent output. 

In this case, possibility (I) cannot hold and thus (II) or (III) is true. Thus output from L% is correct. 

Case 2 - a - ii) there exists a set L2 composed of (a + b — z) forward links that includes all a links from s to 
A and gives consistent output. 

We first show that L\ and L2 gives the same consistent output. L\ n L2 is obtained from the cut by erasing 
z forward links from B to t that L2 does not include and z — m forward links L\ does not include. From the 
definition of our bound in Lemma [6l YlieL nL r W ^ Thus L\ and L2 give the same consistent output. Since 
L2 gives the correct output when (I) is true, and L\ and L2 give the same consistent output in this case, output 
from L\ is correct when (I) is true. Moreover, we have already shown that L\ gives the correct output if (II) or 
(III) is true. Therefore, L\ always gives correct output. 

Case 2 - b) there is no set of (a + b — z + m) forward links giving consistent output. 

In this case, there are more than z — m adversarial forward links on the cut. Thus (II) cannot hold and (I) or 
(III) is true. If there is no set of (a + b — z) forward links that includes all a links from s to A and gives consistent 
output, then (III) is true. From Lemma [T2l output obtained from (C, C z ) MDS code is correct. Otherwise, suppose 
that there exists a set L2 composed of (a + b — z) forward links that includes all a links from s to A and gives 
consistent output. We show that output obtained from L2 is correct. 

If possibility (I) is true, since all links between s and A and all feedback links are uncorrupted, L2 contains at 
most z corrupted forward links between B and t. From the definition of the Singleton bound, the sum of capacities 
of a links between s and A plus the sum of any b — 2z forward links between B and t is larger than or equal 
to C z . Thus, from uncorrupted a links between s and A and some b — 2z links between B and t which are not 
corrupted, we obtain the correct output rate C z . Since L2 gives consistent output, the decoded output is correct. 

If possibility (III) is true, the adversary controls some forward links from s to A such that each feedback link 
transmits g(W), and L2 contains at most z unknown corrupted links. Using condition [T] we will show that the 
output obtained from L2 is correct. If A2 is a set of truly corrupted forward links, the degree of freedom adversary 
can control is at most X^£A 2 /(0 0^2 1 ^ z). From the definition, the degree of freedom of any forward link 
from B to t is equal to the link capacity. From the condition [T] the sum of degree of freedom of truly corrupted 
links in A2 and the sum of z forward links between B and t which are not included in L2 is less than or equal 
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to C — C z . Therefore, L 2 contains at least C — (C — C z ) = C z uncorrupted symbols. Since L 2 gives consistent 
output, the decoded output from L 2 is correct. As shown above, when (III) is true, we can obtain correct output 
using condition 1. 

Therefore, either (I) or (III) is true, L 2 gives the correct output. 

Proof of Lemma [74] : 

Since b ^ 2z, a claim (Xi,Pi) for any feedback link I is not reliably transmitted to the sink and adversarial 
links between B and t can corrupt this claim arbitrarily. Thus, the sink can receive different claims on different 
incoming links. Let G(l) be the set of distinct claims G(l) = {(Xu, Pu), .., (Xik, Pik),Y} where Y denotes that 
no claims received. Here is the outline of the proof. We first show that at least one adversarial link is removed 
except when b > z and the sink receives no claim on all b links for all feedback links. When b > z and the sink 
receives no claim on all b links, since all b links cannot be corrupted at the same time, the sink knows that B does 
not send any claim. This case exactly corresponds to the case 2 in the proof of Lemma [13] and we achieve the 
correct output. This completes the proof. Note that the same guess-and-forward strategy in Section IV-B2I is used. 

First we show that any uncorrupted (a + b — 2z) forward links between s and A give the correct decoded output 
with rate C z . From the definition of Singleton bound, after erasing b ^ 2z links between B and t and any set of 
2z — b links between s and A, the sum of the remaining link capacities are larger than or equal to C z . Thus any 
uncorrupted (a + b — 2z) links between s and A give the correct message. 

Now we assume that (Xn, Pu) is received on n-i links and Y is received on n^ +1 links (m + .. + n^ +1 = b). First 
we ignore any (Xu , Pu) claiming that there are more than z — (b — rii) adversarial links between s and A. Since Xu 
is shown on n, links, believing Xu implies more than z adversarial links on the cut which is a contradiction. Thus, 
each of remaining claim (Xh, Py) specifies a set Lj which is composed of at least (a— (z— (b— = a+b—z—rii 
links between s and A claimed to be correct by (X[j, Pij). For each such claim, we check the consistency of the 
decoded outputs of Lj. We show that if there exist two different claims (Xu, Pu) and [X\j, Pij) both corresponding 
to consistent outputs, then those two outputs should be the same. Since \Li\ = a + b — z — ni, \Lj\ = a + b — z — rij, 
and \Li U Lj \ ^ a, 

\Li fl Lj\ ^ (a + b — z — rii) + (a + b — z — rij) — a 
^ a + b-2z. 

As we mentioned at the beginning of the proof, the sum of capacities of any (a + b — 2z) link between s and A 
is larger than or equal to C z . Therefore Lj and Lj give the same consistent output. 

Suppose that we have figured out that a set of links L gives the correct consistent decoded output. In this case, 
we add remaining links not included in L sequentially to L, and check the consistency of any decoded output with 
rate C z . If outputs are no more consistent, the added link is adversarial (*). 
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Now we show that at least one adversarial link is removed except when b > z and the sink receives no claim 
on all b links for all feedback links. 

Case 1) all claims are ignored or none of the remaining claims gives consistent output or all claims (Xu,Pu) 
that give consistent output satisfy that Pu / W 

In this case, there are only two possibilities. 

(I) feedback link I is adversarial. 

(II) feedback link I is reliable and all b links between B and t are adversarial. 

If b > z, then possibility (II) cannot hold and feedback link I is adversarial. We remove it. If b ^ z, the sink 
checks the consistency of outputs from each set of (a + b — z) links between s and A. If no (a + b — z) links 
set give consistency, then there are more than z — b adversarial links between s and A. Thus possibility (I) is true 
and we remove feedback link /. Otherwise, there exists a set L of (a + b — z) links giving consistency. Since this 
set contains at most z corrupted links, and thus includes at least (a + b — 2z) uncorrupted links between s and A. 
Then the sum of capacities of uncorrupted links are larger than or equal to C z . Thus L gives correct output rate 
C z . From (*), we can detect forward adversarial links in this case. 

Case 2) there exists a claim (Xu, Pu) giving consistent output and Pu = W. 

We show that the output obtained from claim (Xu, Pu) should be correct. If there is at least one uncorrupted link 
showing (Xu,Pu), then feedback link / is also not corrupted since Pu = W, and this claim gives correct output 
rate C z . Otherwise, if all n« links showing this claim are adversarial, then there are at most z — n« adversarial links 
between s and A. Then L.; includes at least (a + b — z — rij) — (z — raj) = a + b — 2z uncorrupted links, and thus 
gives correct consistent output. From (*), we can also detect adversarial links in this case. 

Case 3) only Y gives consistent output and b < z. 

In this case, the set of all a forward links from s to A gives consistent output. The a links between s and A 
include at least a — z^a + b — 2z uncorrupted links since b < z. Thus we obtain correct consistent output from 
a links and detect adversarial links from (*). 

Case 4) only Y gives consistent output, b > z, and at least one of b links between B and t show claim different 
from Y, i.e., n&+i < b. 

Case 4 - a) n^+i < b — z. 

If feedback link I is reliable, the links showing claims different from Y are adversarial. Thus there are more than 
b — rik + i > z adversarial links and this is a contradiction. Thus feedback link I is adversarial and we remove it. 
Case 4 - b) b — z < rik+i ^ z. 

Y is shown on rik+i ^ b — z links and b — rik+i ^ b — z links show claims different from Y . Thus there are 
at least b — z adversarial links between B and t. Then there are at most 2z — b adversarial links between s and A 
and at least a + b — 2z uncorrupted links. Thus we also obtain correct output from a links and use (*) to detect 
the adversarial links. 

Case 4 - c) z < rik+i < b. 
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Since nf.+i > z, feedback link I transmits g(W) = g{W) to B and B does not send any claim. Thus, the links 
showing claims different from Y are all adversarial. 

For cases 1-4, we have shown that at least one adversarial link is removed when b > z and the sink receives 
some claim different from Y for any feedback link. 

To complete the proof it is now sufficient to show that correct output can be achieved when b > z and the sink 
receives no claim for all feedback links I. Since b > z, at least one link between B and t is uncorrupted. Since all 
b links show Y, this means that each feedback link transmits g(W) = g(W) and B does not send any claim. This 
case corresponds to the case 2 in Lemma [13] Therefore, we can obtain the correct output. 
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